CVE-2022-40626

2022-09-1411:15:53

Debian Security Bug Tracker

security-tracker.debian.org

cve-2022-40626

reflected javascript code

backurl parameter

zabbix frontend

fake account

predefined login

password

role

unix

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

35.5%

JSON

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.

OSVersionArchitecturePackageVersionFilename
Debian12allzabbix< 1:6.0.7+dfsg-2zabbix_1:6.0.7+dfsg-2_all.deb
Debian11allzabbix< 1:5.0.8+dfsg-1zabbix_1:5.0.8+dfsg-1_all.deb
Debian999allzabbix< 1:6.0.7+dfsg-2zabbix_1:6.0.7+dfsg-2_all.deb
Debian13allzabbix< 1:6.0.7+dfsg-2zabbix_1:6.0.7+dfsg-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	zabbix	< 1:6.0.7+dfsg-2	zabbix_1:6.0.7+dfsg-2_all.deb
Debian	11	all	zabbix	< 1:5.0.8+dfsg-1	zabbix_1:5.0.8+dfsg-1_all.deb
Debian	999	all	zabbix	< 1:6.0.7+dfsg-2	zabbix_1:6.0.7+dfsg-2_all.deb
Debian	13	all	zabbix	< 1:6.0.7+dfsg-2	zabbix_1:6.0.7+dfsg-2_all.deb